CVE Vulnerability Catalog

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 are vulnerable to GraphQL query injection in the export-status component. The 'export_id' value is interpolated directly into the GraphQL query string, allowing an attacker to append root-level selections such as schema introspection and send them to the Rapid7 export API using the operator's API key.

The lazy_html library (versions 0.1.0 through 0.1.13) contains a mutation XSS vulnerability. LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 decide whether to escape an element's text based solely on its tag name, so style or script elements inside SVG/MathML foreign content are serialized as HTML raw-text elements without escaping. Encoded markup such as &lt;/style&gt;&lt;img src=x onerror=...&gt; inside <svg><style> closes the element on re-parse and becomes live markup.

The Tohoku Electric Power smartphone application "Yorisou e Net" uses a hard-coded cryptographic key. This may allow an attacker to retrieve the hard-coded cryptographic key from the affected product.

A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. The vulnerability affects the CmsContentAdminController function in SysUserAdminController.java within the exportExcel/exportData component. Manipulation of the userId/deptId arguments causes authorization bypass, and the attack can be initiated remotely. The exploit has been made publicly available and could be used for attacks.

A vulnerability in django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit. This allows bypassing login attempt throttling mechanisms.

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement.

A cross-site scripting vulnerability was identified in volotat Anagnorisis up to version 0.4.11, in the html function of PlaylistManager.js (Media Filename Handler component). Manipulation of the file_path argument allows injection of malicious code. The exploit is publicly available and the vendor did not respond to the disclosure.

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf() sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 MessageImprint to the attacker-selected endpoint. The default self-hosted configuration does not set VITE_CORS_PROXY_URL, so the request bypasses the proxy's ALLOWED_TSA_HOSTS checks and is sent directly. The disclosed digest can confirm that a document matches a known file and can correlate the same document across users without revealing its contents. This vulnerability is fixed in 2.8.7.

In Mbed TLS 3.2.0 through 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

IBM PowerVM Hypervisor versions FW1120.00-FW1120.01, FW1110.00-FW1110.31, and FW1060.00-FW1060.81 are affected by a vulnerability in a hypervisor call interface. An attacker with root access to a guest partition can read a limited amount of hypervisor memory, potentially exposing sensitive data belonging to the hypervisor or other guest partitions, resulting in a confidentiality impact. The attacker has no control over which memory contents are returned.

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.

IBM OPENBMC versions FW1120.00-FW1120.01, FW1110.00-FW1110.31, and FW1060.00-FW1060.81 are affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system.

IBM Db2 Mirror for i versions 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption.

IBM PowerVM Hypervisor versions FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81, and FW950.00-FW950.H3 are affected by a vulnerability in the partition resource dump interface. An attacker with authenticated administrator-level access to the HMC or service processor can obtain a limited snapshot of partition processor state. Successful exploitation results in a confidentiality impact to the managed system.

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure.

The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators.

The Post Grid WordPress plugin before version 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide. Users with the Contributor role and above can store iframe, style, and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement, and spoofed input forms) that renders to any visitor and to administrators reviewing the content.

A vulnerability was identified in huanzi-qch base-admin in the Save function of CommonController.java (Add User Handler component). Manipulation of the Username argument leads to cross site scripting, and the attack can be initiated remotely. The exploit is publicly available and might be used.

GitLab CE/EE contains a race condition in the MCP search tool's shared state handling that could cause search results to be returned under an incorrect user context. Affected versions are from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.